Skip to content
Banking & Compliance

The ICO Agentic AI Call For Evidence Closes On 20 November. UK Brokers And Fintechs Have Eight Questions To Answer, And A Statutory Code Will Be Written From The Replies

On 8 October 2026 the Information Commissioner's Office opened a six-week call for evidence on agentic AI, closing on 20 November, after securing data protection changes from ten foundation model developers and making enquiries with OpenAI, Anthropic, Meta and the AI Security Institute about agents that bypassed protections and reached external systems. The replies will feed the ICO's statutory code of practice on AI and automated decision-making. This article sets out the eight sections, what accountability, transparency, automated decisions, purpose limitation and data security mean for a trading firm running agents near client data, and why a UK broker, prop firm or fintech should treat the questions as a checklist.

AlchmAI Editorial9 min read

20 Nov 2026

Closing date of the ICO call for evidence on agentic AI, opened on 8 October 2026 (ICO consultation page)

10

Foundation model developers that made or committed to data protection changes after ICO engagement (ICO, 8 October)

63%

Respondents citing AI as a source of risk to the UK financial system, +32 percentage points on the previous survey (Bank of England 2026 H2 Systemic Risk Survey, 30 September)

10+

Brokers and platform vendors that wired AI agents into live client accounts in the first half of 2026 (Finance Magnates, 24 September)

On 8 October 2026 the Information Commissioner's Office opened a six-week call for evidence on agentic AI, the first document from a UK regulator that asks firms, in writing, how their AI agents are tracked, what data they touch, when a decision is solely automated and how a person can contest it. The ICO agentic AI call for evidence closes on 20 November 2026 and, in the ICO's words, "will also support the development of our forthcoming statutory code of practice on AI and automated decision-making." For a UK broker, prop firm or fintech that has connected an agent to anything holding client data, the eight sections are a checklist whether or not the firm ever replies.

The call did not arrive alone. On the same day the ICO said ten foundation model developers had made or committed to data protection changes, and that it had made enquiries with OpenAI, Anthropic, Meta and the UK's AI Security Institute about recent agent testing in which agents reportedly bypassed protections, used unauthorised communication channels and accessed external systems. Richard Nevinson, the ICO's Director of Technology Regulation, put it in one line: "the fact AI agents act with autonomy is not an excuse for poor compliance."

What Did The ICO Publish On 8 October 2026?

Three things that need reading together: the close of a foundation model programme begun in 2025, with ten developers committing to changes; the disclosure of enquiries with OpenAI, Anthropic, Meta and the AI Security Institute about agent testing in which agents "reportedly bypassed protections, used unauthorised communication channels" and "accessed external systems such as Hugging Face"; and the call for evidence itself, open until the end of 20 November 2026. After two years negotiating with model developers, the ICO is turning to the layer above the model, where a broker or a software vendor wires it into tools, accounts and customer records. That is a message to deployers, not only to the labs.

What Does The ICO Agentic AI Call For Evidence Actually Ask?

Drawing on the ICO's headings and the summaries published by TLT on 12 October and Pinsent Masons on 9 October, five themes bite hardest for a firm running agents near client data.

  • Accountability: who sets the purpose and scope of each processing step when several organisations, models, agents and tools are involved, and, in TLT's words, "how agentic actions are tracked." In practice this is an agent ledger: a record of every tool call with the agent identity, the instruction it acted on, the data it read, the system it wrote to and who or what authorised it.
  • Transparency: what an agent can access, what it does with that information and who is responsible at each stage. For a broker, that is a notice saying the account assistant can read balances and orders, cannot move money, and logs every query.
  • Automated decision-making: whether any decision with a legal or similarly significant effect is made solely by automated means under Article 22 of UK GDPR, including mixed automated and human decisions. A prop firm whose agent flags a breach and a person then clicks approve must be able to show the person actually reviewed it.
  • Fairness and purpose limitation: whether information an agent remembers from one task may be reused for another. TLT's reading is that memory carried across tasks does not make the new purpose compatible with the original one; a client's income stored for an appropriateness check and reused for marketing has changed purpose.
  • Data security: how security failures or malicious instructions spread through an agent's connectors. Pinsent Masons lists the measures the ICO highlights as "agent identities, permissions and guardrails, audit logging, transparency measures." For a trading firm, permissions means scoping an agent's credentials to read-only or a single account, not handing it the operator's API key.

Why Are The Bank Of England And The Cabinet Office Saying The Same Thing?

Because the evidence that agents behave unexpectedly is now in official UK documents. The Financial Policy Committee's record of its 25 September 2026 meeting, published on 30 September, states that "recent frontier AI test-environment incidents in 2026 Q3 demonstrated that, under permissive or weakened safeguards, increasingly autonomous models could take unexpected actions, including exploiting vulnerabilities and accessing systems beyond their intended task." The Bank's 2026 H2 Systemic Risk Survey, answered by 57 firms, reports that respondents citing "risks surrounding artificial intelligence" as a source of risk reached 63%, "+32 percentage points" on the 2026 H1 survey.

Then, on 12 October 2026, a government release issued by the Cabinet Office, the AI Security Institute, the National Cyber Security Centre and the Department for Digital, Culture, Media and Sport said the Cyber Security and Resilience Bill regime would be used to consider "how serious AI incidents and near misses can be identified and reported", and that "a major incident involving AI agents could play out quicker and wider" than other major incidents. Kanishka Narayan, the Minister for Artificial Intelligence, told developers at Imperial College London: "if you cannot adequately control the risks, do not release the system." Three institutions, one theme: agents act, and someone has to be able to show what they did.

Who Carries The Responsibility When An Agent Acts?

The version of Anthropic's Usage Policy that takes effect on 12 November 2026 states that "users are responsible for ensuring that agents they build or deploy, including actions those agents take through tools, browsers, or connected systems, comply with this Usage Policy." The lab is pushing responsibility for an agent's actions to the deployer at the same moment the regulator is asking the deployer to prove those actions are tracked. A firm that cannot reconstruct what its agent did has accepted liability in one document and cannot evidence compliance in the other.

The trading industry walked into this early. Finance Magnates reported on 24 September 2026 that FM Intelligence counted "at least 10 brokers and platform vendors that wired AI agents into live client accounts" in the first half of 2026, some read-only and some able to place trades. The same article notes that the Financial Conduct Authority "has not written rules for AI agents on client accounts" and that its AI review proposed relying on the Consumer Duty and the Senior Managers Regime. The ICO's questions therefore land on firms that have, so far, no agent-specific rules.

Our View: Answer It, Because Someone Else Will

A call for evidence is shaped by whoever replies. If the replies come from the large banks and the model labs, the statutory code will describe their systems. A 40-person CFD broker or a prop firm with three engineers will then be measured against a template written for organisations fifty times its size. Stephanie Lees, Managing Senior Associate at Pinsent Masons, called the call "a significant regulatory moment that organisations cannot afford to ignore," and we agree, for a more selfish reason: the smaller firms have the most to lose from a code they did not help write. Every question is also one a client, an auditor or the FCA could ask next year, and in our experience the gap is nearly always the same: the agent works, the logging does not, and nobody can say which policy version the agent was following at 14:03 on a Tuesday. Building that log is ordinary engineering.

“The ICO has not told anyone what an agent may do. It has asked everyone to show what their agents did. The firms that can answer will write the code; the firms that cannot will live under it.”

What It Means For Trading And Fintech Firms

  • Brokers and CFD providers: inventory every agent with access to client accounts, including third-party connectors such as ChatGPT or MCP servers, record whether each is read-only, drafts orders for approval, or executes, say exactly that to clients, and keep a per-account log of every query and action.
  • Prop trading firms: list every agent-assisted decision that affects a trader's money, such as breach flags, evaluation passes and payout holds, mark which are solely automated, evidence the human review, and give the trader a route to contest it.
  • Fintech and trading startups: give each agent its own identity and the narrowest credential that works, never a shared operator key, and store the instruction, tool calls and data touched for every run; due diligence asks the same questions the ICO does.
  • Trading education and tools: if an agent remembers anything about a student across sessions, document what is stored, why, and whether the purpose has changed between features.
  • Research and quant teams: where agents touch any personal information, keep the agent ledger alongside your data lineage, and consider replying so the code describes systems like yours.

The Bottom Line

The ICO agentic AI call for evidence, closing on 20 November 2026, is the first time a UK regulator has asked firms in writing how their agents are tracked, what data they reach, when a decision is solely automated and how a person can contest it, and the replies will shape a statutory code of practice on AI and automated decision-making. It lands as the Bank of England records autonomous models "accessing systems beyond their intended task" and as model providers push responsibility for agents' actions onto the firms that deploy them. A UK broker, prop firm or fintech with an agent near client data should treat the eight sections as a checklist, build the agent ledger that answers the accountability question, and consider replying before 20 November. AlchmAI, a London trading technology and AI studio, builds the controls and logging that make those answers possible; this article is descriptive, not legal advice.

References & Further Reading

Banking & ComplianceCompliance & Regulatory SystemsAgentic AIAgentic AI LondonEnterprise-Grade Security & ScalabilityICOUK GDPR
Share Email
AI

AlchmAI Editorial

Research and analysis, London

The AlchmAI team writes about the markets, technology and regulation we work with every day. We build trading platforms, real-time charts and AI analysis tools for brokers, prop firms and fintech teams from our office in Mayfair, London. Every article lists its sources. Nothing we publish is investment advice.

This article is general information and commentary. It is not investment advice or a recommendation to buy or sell any investment. Important information

Keep reading

All articles